Skip to content

Commit 54b5e3f

Browse files
aji70aji70
authored
Merge branch 'main' into main
2 parents 30b62b8 + c68506f commit 54b5e3f

27 files changed

Lines changed: 793 additions & 351 deletions

File tree

‎.github/CODEOWNERS‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,3 +6,9 @@
66

77
# Nest.js backend – backend team reviews all changes under backend/
88
/backend/ @MyFanss/backend
9+
10+
# Next.js frontend – frontend team reviews all changes under frontend/
11+
/frontend/ @MyFanss/frontend
12+
13+
# Release docs including smoke test matrix – frontend team owns these
14+
/docs/release/ @MyFanss/frontend

‎.github/workflows/abi-snapshot.yml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -20,15 +20,15 @@ jobs:
2020
working-directory: contract
2121
steps:
2222
- name: Checkout
23-
uses: actions/checkout@v4
23+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
2424

2525
- name: Set up Rust
26-
uses: dtolnay/rust-toolchain@stable
26+
uses: dtolnay/rust-toolchain@3c5f7ea28cd621ae0bf5283f0e981fb97b8a7af9 # stable
2727
with:
2828
targets: wasm32-unknown-unknown
2929

3030
- name: Cache Rust dependencies
31-
uses: Swatinem/rust-cache@v2
31+
uses: Swatinem/rust-cache@42dc69e1aa15d09112580998cf2ef0119e2e91ae # v2
3232
with:
3333
workspaces: contract
3434

‎.github/workflows/audit-check.yml‎

Lines changed: 8 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -18,10 +18,10 @@ jobs:
1818

1919
steps:
2020
- name: 📥 Checkout code
21-
uses: actions/checkout@v4
21+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
2222

2323
- name: 🟢 Setup Node.js
24-
uses: actions/setup-node@v4
24+
uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
2525
with:
2626
node-version: "20"
2727

@@ -58,6 +58,8 @@ jobs:
5858
echo "::error::High vulnerabilities in backend: $HIGH"
5959
exit 1
6060
fi
61+
62+
- name: 📦 Check frontend audits
6163
id: frontend-audit
6264
working-directory: ./frontend
6365
run: |
@@ -89,9 +91,11 @@ jobs:
8991
echo "❌ **HIGH vulnerabilities detected**" >> $GITHUB_STEP_SUMMARY
9092
echo "::error::High vulnerabilities in frontend: $HIGH"
9193
exit 1
92-
fi with audit summary
94+
fi
95+
96+
- name: 💬 Comment on PR with audit summary
9397
if: github.event_name == 'pull_request' && always()
94-
uses: actions/github-script@v7
98+
uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7
9599
with:
96100
github-token: ${{ secrets.GITHUB_TOKEN }}
97101
script: >-

‎.github/workflows/changelog.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -16,13 +16,13 @@ jobs:
1616

1717
steps:
1818
- name: Checkout code
19-
uses: actions/checkout@v4
19+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
2020
with:
2121
fetch-depth: 0
2222
token: ${{ secrets.GITHUB_TOKEN }}
2323

2424
- name: Setup Node.js
25-
uses: actions/setup-node@v4
25+
uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
2626
with:
2727
node-version: '20'
2828

‎.github/workflows/ci.yml‎

Lines changed: 11 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -49,9 +49,9 @@ jobs:
4949
SOROBAN_RPC_URL: https://soroban-testnet.stellar.org
5050

5151
steps:
52-
- uses: actions/checkout@v4
52+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
5353

54-
- uses: actions/setup-node@v4
54+
- uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
5555
with:
5656
node-version: ${{ matrix.node }}
5757
cache: 'npm'
@@ -103,9 +103,9 @@ jobs:
103103
NODE_ENV: test
104104

105105
steps:
106-
- uses: actions/checkout@v4
106+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
107107

108-
- uses: actions/setup-node@v4
108+
- uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
109109
with:
110110
node-version: '20'
111111
cache: 'npm'
@@ -144,9 +144,9 @@ jobs:
144144
node: ['20', '22']
145145

146146
steps:
147-
- uses: actions/checkout@v4
147+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
148148

149-
- uses: actions/setup-node@v4
149+
- uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
150150
with:
151151
node-version: ${{ matrix.node }}
152152
cache: 'npm'
@@ -199,9 +199,9 @@ jobs:
199199
NODE_ENV: test
200200

201201
steps:
202-
- uses: actions/checkout@v4
202+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
203203

204-
- uses: actions/setup-node@v4
204+
- uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
205205
with:
206206
node-version: '20'
207207
cache: 'npm'
@@ -227,10 +227,10 @@ jobs:
227227
timeout-minutes: 30
228228

229229
steps:
230-
- uses: actions/checkout@v4
230+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
231231

232232
- name: Cache Cargo registry
233-
uses: actions/cache@v4
233+
uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
234234
with:
235235
path: |
236236
~/.cargo/registry/index
@@ -242,7 +242,7 @@ jobs:
242242
${{ runner.os }}-cargo-registry-
243243
244244
- name: Cache Cargo target directory
245-
uses: actions/cache@v4
245+
uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
246246
with:
247247
path: contract/target
248248
key: ${{ runner.os }}-contract-target-${{ hashFiles('contract/**/Cargo.lock') }}

‎.github/workflows/commitlint.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -10,12 +10,12 @@ jobs:
1010

1111
steps:
1212
- name: Checkout code
13-
uses: actions/checkout@v4
13+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
1414
with:
1515
fetch-depth: 0
1616

1717
- name: Setup Node.js
18-
uses: actions/setup-node@v4
18+
uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
1919
with:
2020
node-version: '20'
2121

‎.github/workflows/contract-release.yml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -26,10 +26,10 @@ jobs:
2626

2727
steps:
2828
- name: 📥 Checkout
29-
uses: actions/checkout@v4
29+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
3030

3131
- name: 🦀 Cache Cargo registry
32-
uses: actions/cache@v4
32+
uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
3333
with:
3434
path: |
3535
~/.cargo/registry/index
@@ -41,7 +41,7 @@ jobs:
4141
${{ runner.os }}-cargo-registry-
4242
4343
- name: 🏗️ Cache Cargo target
44-
uses: actions/cache@v4
44+
uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
4545
with:
4646
path: contract/target
4747
key: ${{ runner.os }}-contract-target-${{ hashFiles('contract/Cargo.lock') }}
@@ -211,7 +211,7 @@ jobs:
211211
212212
- name: 📝 Comment on PR with checklist summary
213213
if: github.event_name == 'pull_request' && always()
214-
uses: actions/github-script@v7
214+
uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7
215215
with:
216216
github-token: ${{ secrets.GITHUB_TOKEN }}
217217
script: |

‎.github/workflows/dependency-review.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,6 @@ jobs:
99
runs-on: ubuntu-latest
1010
steps:
1111
- name: 'Checkout Repository'
12-
uses: actions/checkout@v4
12+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
1313
- name: 'Dependency Review'
14-
uses: actions/dependency-review-action@v4
14+
uses: actions/dependency-review-action@a6993e2c61fd5dc440b409aa1d6904921c5e1894 # v4

‎.github/workflows/sbom.yml‎

Lines changed: 86 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,86 @@
1+
name: SBOM Generation
2+
3+
on:
4+
push:
5+
branches: [main, develop]
6+
paths:
7+
- 'frontend/Dockerfile'
8+
- 'frontend/package*.json'
9+
- 'backend/Dockerfile'
10+
- 'backend/package*.json'
11+
- '.github/workflows/sbom.yml'
12+
pull_request:
13+
branches: [main, develop]
14+
paths:
15+
- 'frontend/Dockerfile'
16+
- 'frontend/package*.json'
17+
- 'backend/Dockerfile'
18+
- 'backend/package*.json'
19+
- '.github/workflows/sbom.yml'
20+
workflow_dispatch:
21+
22+
permissions:
23+
contents: read
24+
25+
jobs:
26+
sbom-frontend:
27+
name: SBOM – Frontend container
28+
runs-on: ubuntu-latest
29+
timeout-minutes: 20
30+
31+
steps:
32+
- name: Checkout
33+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
34+
35+
- name: Build frontend Docker image
36+
run: |
37+
docker build \
38+
--file frontend/Dockerfile \
39+
--tag myfans/frontend:ci \
40+
frontend/
41+
42+
- name: Generate SBOM (SPDX JSON)
43+
uses: anchore/sbom-action@df80a981bc6edbc4e220a492d3cbe9f5547a6e75 # v0.17.9
44+
with:
45+
image: myfans/frontend:ci
46+
format: spdx-json
47+
artifact-name: sbom-frontend.spdx.json
48+
output-file: sbom-frontend.spdx.json
49+
50+
- name: Upload SBOM artifact
51+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
52+
with:
53+
name: sbom-frontend
54+
path: sbom-frontend.spdx.json
55+
retention-days: 90
56+
57+
sbom-backend:
58+
name: SBOM – Backend container
59+
runs-on: ubuntu-latest
60+
timeout-minutes: 20
61+
62+
steps:
63+
- name: Checkout
64+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
65+
66+
- name: Build backend Docker image
67+
run: |
68+
docker build \
69+
--file backend/Dockerfile \
70+
--tag myfans/backend:ci \
71+
backend/
72+
73+
- name: Generate SBOM (SPDX JSON)
74+
uses: anchore/sbom-action@df80a981bc6edbc4e220a492d3cbe9f5547a6e75 # v0.17.9
75+
with:
76+
image: myfans/backend:ci
77+
format: spdx-json
78+
artifact-name: sbom-backend.spdx.json
79+
output-file: sbom-backend.spdx.json
80+
81+
- name: Upload SBOM artifact
82+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
83+
with:
84+
name: sbom-backend
85+
path: sbom-backend.spdx.json
86+
retention-days: 90

0 commit comments

Comments
 (0)